Require a token for writes and quarantine what nobody vouches for

Sixteen mutating routes now refuse a caller who cannot present the token the
server started with; queries stay open, because a question is not a write. The
environment variable is ELY_EYE_AUTH_TOKEN, following the repo's env_prefix
convention — the shorter name I reached for first returned 403 where the smoke
expected 401, and the server printed the reason.

Words from a stranger are quarantined on the way in: an HTTP upload is
third_party by definition, and a sentence carrying an instruction-shaped phrase
is quarantined whoever wrote it. A quarantined atom stays findable and stays out
of the compiled context until a second, live, unquarantined source agrees with
its rarest words. Corroboration is computed at read time because it is a
property of the corpus now, not of the moment a memory was written; it is
term-level, and the docstring says so.

forget now erases the source row and the compiled contexts beside the atoms, so
a forgotten memory leaves nothing that can still speak. The semantic cache key
carries a store revision, which fixes a real staleness: a context compiled
before new evidence arrived kept its old quarantine decision forever.

bench.audit --product still pointed at evals.py, which the p1-6 split moved into
backend/src/ely_eye/proofs/. It failed fast, but the anti-self-justification
rule had quietly stopped auditing the product; it now walks the package, and a
test pins that the package exists and holds no re-roll.

Gates: pytest 306 passed; ruff clean; mypy cold cache 24 errors in 9 files, the
recorded baseline, net zero; pyright 0 errors on the 23 backend files and the 2
bench files; go build/vet/test and gofmt clean; npm run build 221.39 kB with
eslint exit 0; bench/filesize_check clean; bench.audit --product clean over 31
harness files; scripts/mcp_write_smoke.sh PASS with the gate live across two
servers and the MCP child.

backend/src/ely_eye/compiler.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import hashlib
 from collections.abc import Iterable
 
+from . import trust
 from .cache_fabric import SEMANTIC_LAYER, CacheFabric
 from .config import Settings, get_settings
 from .db import Database
@@ -25,7 +26,7 @@ class ContextCompiler:
         self.cache = CacheFabric(self.settings, self.db)
 
     def compile(self, question: str, profile: RuntimeProfile) -> CompiledContext:
-        cache_key = self.cache.semantic_key(question, profile.value)
+        cache_key = self.cache.semantic_key(question, profile.value, self.db.revision())
         cached = self.cache.read_semantic_cache(cache_key)
         if cached is not None:
             compiled = CompiledContext.model_validate(cached)
@@ -40,7 +41,8 @@ class ContextCompiler:
             self.cache.record_miss(SEMANTIC_LAYER, cache_key)
         plan = self.plan(question, profile)
         hits = self.retrieval.search(plan.retrieval_query, plan.evidence_budget_atoms).hits
-        packed_text, token_total = self._pack_hits(hits, plan.token_budget, plan.retrieval_query)
+        citable, held = self._split_citable(hits)
+        packed_text, token_total = self._pack_hits(citable, plan.token_budget, plan.retrieval_query)
         trace_id = hashlib.sha256(f"{cache_key}:{token_total}".encode()).hexdigest()[:16]
         compiled = CompiledContext(
             plan=plan,
@@ -48,6 +50,7 @@ class ContextCompiler:
             packed_text=packed_text,
             token_equivalent=token_total,
             cache_trace_id=trace_id,
+            quarantined_excluded=[hit.atom.atom_id for hit in held],
         )
         self.cache.write_semantic_cache(cache_key, compiled.model_dump(mode="json"))
         return compiled
@@ -71,6 +74,15 @@ class ContextCompiler:
             ],
         )
 
+    def _split_citable(self, hits: list[RetrievalHit]) -> tuple[list[RetrievalHit], list[RetrievalHit]]:
+        """A quarantined atom reaches the prompt only when a trusted source says the same thing."""
+
+        citable: list[RetrievalHit] = []
+        held: list[RetrievalHit] = []
+        for hit in hits:
+            (citable if trust.is_citable(hit.atom, self.db) else held).append(hit)
+        return citable, held
+
     def _compression_strategy(self, profile: RuntimeProfile, modalities: Iterable[Modality]) -> str:
         has_visual = any(modality in {Modality.image, Modality.pdf_page, Modality.video_frame, Modality.ui_screenshot} for modality in modalities)
         if profile == RuntimeProfile.extreme_context: